Re: [Sidrops] Alvaro Retana's No Objection on draft-ietf-sidrops-rtr-keying-03: (with COMMENT)

[Sean Turner <[e-mail]>]

> On Jan 23, 2019, at 12:46, Alvaro Retana <[e-mail]> wrote:
> 
> Alvaro Retana has entered the following ballot position for
> draft-ietf-sidrops-rtr-keying-03: No Objection
> 
> When responding, please keep the subject line intact and reply to all
> email addresses included in the To and CC lines. (Feel free to cut this
> introductory paragraph, however.)
> 
> 
> Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
> for more information about IESG DISCUSS and COMMENT positions.
> 
> 
> The document, along with other ballot positions, can be found here:
> https://datatracker.ietf.org/doc/draft-ietf-sidrops-rtr-keying/
> 
> 
> 
> ----------------------------------------------------------------------
> COMMENT:
> ----------------------------------------------------------------------
> 
> (1) I don't really have a strong objection for this document being a BCP. 
> However, while documenting two different methods, there is no clear indication
> of "what is believed to be the best" [rfc2026], or even better, which method
> should be used in what situations.  I understand that operators have different
> preferences/needs and that prescribing one method as the default in not the
> right thing to do.
> 
> I would really like to see some text (maybe a "Deployment Considerations"
> section) that talks about when one or the other might be preferred/considered.

Right so I am hoping that Randy’s answer helped here.  The only thing I will add is that it really depends on what gear you buy so in some sense I am kind of wobbly on whether we should pick one.

> (2) §4: s/BGP Identifier [RFC4271]/BGP Identifier [RFC6286]

Good catch!

> (3) §4: "In the case where the operator has chosen not to use unique per-router
> certificates, a BGP Identifier of 0 MAY be used." rfc6286 defines the BGP
> Identifier as always being non-zero.  rfc8209 says that "if the same
> certificate is issued to more than one router (and hence the private key is
> shared among these routers), the choice of the router ID used in this name is
> at the discretion of the Issuer."  It seems to me that it doesn't matter which
> ID is used...it just can't be 0.  The simple fix is to just remove the sentence.

Agreed.

> (4) §8: "Enabling the router-to-CA connectivity MAY require connections to
> external networks (i.e., through firewalls, NATs, etc.)."  That "MAY" is out of
> place because this sentence is just stating a fact.

Can do r/MAY require/requires

> (5) §8: "Note that the checks performed by the router in Section 7...SHOULD be
> performed."  Besides confirming the checks from §7, I'm not sure what this
> sentence really contributes...but I do think that the "SHOULD" is out of place
> because the Normative language is already in §7.

These are just consistency checks.

> (6) Nits
> s/used by the the/used by the
> s/corresponds to the private used/corresponds to the private key used

fixed

Cheer,

spt